AWS Cloud Practitioner Practice Exam 1

52 questions with the correct answer and an explanation for each. Topic: CLF-C02. Free, no account needed.

These questions are written from AWS’s published exam guide and service documentation. They are not real exam questions — nobody who has sat the exam may reproduce those, and any site offering them is putting your certification at risk.

Take this test interactively

1. A company launching a new application cannot predict its load. It wants to avoid both paying for idle machines and running out of room, by changing capacity within minutes in either direction. Which cloud advantage addresses this?

  1. Trade fixed expense for variable expense
  2. Benefit from massive economies of scale
  3. Increase speed and agility
  4. Stop guessing capacity

Answer: D — Stop guessing capacity

Capacity that can be raised or lowered within minutes removes the need to estimate it in advance. Trading fixed for variable expense concerns how the cost is incurred, not the ability to resize capacity.

2. An IT group spends most of its effort racking, stacking and powering servers, which does not distinguish its business from any other. Which cloud advantage frees that effort for work that does?

  1. Trade fixed expense for variable expense
  2. Stop guessing capacity
  3. Stop spending money running and maintaining data centres
  4. Go global in minutes

Answer: C — Stop spending money running and maintaining data centres

Moving undifferentiated server work to the provider is the advantage of no longer running and maintaining data centres. Trading fixed for variable expense concerns how costs are incurred, not who does the work.

3. A service must stay usable when one part of the infrastructure fails. Which design approach achieves this?

  1. Add machines when load rises and remove them when it falls
  2. Run it across more than one isolated location
  3. Move it to an instance sized to fit the workload
  4. Automate provisioning and configuration

Answer: B — Run it across more than one isolated location

High availability comes from running across more than one isolated location so that losing one does not take the service down. Adding and removing machines with load is elasticity and does not protect against a location failing.

4. A company wants its architecture review to cover the environmental cost of running a workload. Which pillar covers this?

  1. Sustainability
  2. Operational excellence
  3. Performance efficiency
  4. Cost optimization

Answer: A — Sustainability

Sustainability asks what the environmental cost of running the workload is. Cost optimization concerns achieving the outcome at the lowest price.

5. A review asks whether data and systems are protected, and whether the same outcome could be obtained at a lower price. Which two pillars does this cover? (Choose two.)

  1. Operational excellence
  2. Sustainability
  3. Cost optimization
  4. Reliability
  5. Security

Answer: C,E — Cost optimization / Security

Protection of data and systems is the security pillar and lowest price for the outcome is cost optimization. Reliability, sustainability and operational excellence ask about recovery, environmental cost, and running and improving the system.

6. A team is building a scalable hybrid platform while modernising existing workloads and building new ones. Which AWS CAF perspective covers this work?

  1. Security
  2. Governance
  3. Operations
  4. Platform

Answer: D — Platform

Building the scalable hybrid platform and modernising or building workloads is the Platform perspective. Operations is about delivering services at the level the business needs.

7. A company wants to move its infrastructure, rather than individual applications, to the cloud without buying new hardware, rewriting applications or changing existing operations. Which migration strategy fits?

  1. Replatform
  2. Relocate
  3. Retain
  4. Rehost

Answer: B — Relocate

Relocate moves infrastructure at the hypervisor level with no new hardware, rewrites or operational change. Rehost moves the application itself.

8. A system is too complex to move yet, and its major refactoring is being postponed. Which strategy applies for now?

  1. Repurchase
  2. Rehost
  3. Retain
  4. Retire

Answer: C — Retain

Retain keeps the system running where it is for now, which suits something too complex to move yet. Retire would switch it off.

9. A portfolio review finds a legacy system with no business case to move and a separate application that nobody uses any more. Which two strategies apply, one to each? (Choose two.)

  1. Rehost
  2. Retire
  3. Relocate
  4. Repurchase
  5. Retain

Answer: B,E — Retire / Retain

Retain leaves the legacy system in place and retire decommissions the unused application. The other strategies all move or replace something.

10. A company is migrating a database to a target engine that differs from the source engine and needs the schema converted. Which service handles the conversion?

  1. AWS Application Migration Service
  2. AWS Database Migration Service
  3. AWS Migration Hub
  4. AWS Schema Conversion Tool

Answer: D — AWS Schema Conversion Tool

The Schema Conversion Tool converts a schema when the target engine differs from the source. Database Migration Service moves the data, with the source able to stay in use.

11. A company already owns software licences under agreements it has paid for and wants to use them on AWS. Which approach fits?

  1. AWS License Manager alone
  2. Bring Your Own License (BYOL)
  3. Instances with the licence cost included in the hourly price
  4. Switching to a SaaS subscription

Answer: B — Bring Your Own License (BYOL)

BYOL suits an organisation with existing agreements it has already paid for. License Manager only tracks usage against the terms held and does not supply licences.

12. Which two are ways that automating provisioning and configuration reduces cost? (Choose two.)

  1. Converting capital expenditure into operating expenditure
  2. Lower hardware prices through the provider's aggregated purchasing
  3. Less human time spent on repetitive work
  4. Matching an oversized instance to the actual workload
  5. Fewer costly mistakes, such as a forgotten test instance running for a month

Answer: C,E — Less human time spent on repetitive work / Fewer costly mistakes, such as a forgotten test instance running for a month

Automation saves repetitive human time and avoids costly errors. Aggregated purchasing is economies of scale, the capex-to-opex shift comes from pay-as-you-go, and matching instance size is rightsizing.

13. A company runs a customer-facing application on Amazon EC2 instances. The security team asks who must apply security patches to the guest operating system. Which statement is correct?

  1. AWS, because it operates the physical hosts the instances run on
  2. AWS, through the hypervisor it patches on the customer's behalf
  3. The customer, because the guest operating system on EC2 is theirs to maintain
  4. AWS, because patch management is an inherited control

Answer: C — The customer, because the guest operating system on EC2 is theirs to maintain

On EC2 the customer looks after the guest operating system, including updates and security patches. Patch management is a shared control, not an inherited one: AWS patches the infrastructure and the customer patches the guest OS.

14. A company moves a database it manages on EC2 instances to a more abstracted managed service. How does its share of the security responsibility change?

  1. It shrinks, because AWS operates more of the stack
  2. It disappears, because AWS takes over data permissions as well
  3. It stays the same, because the customer always manages the operating system
  4. It grows, because managed services add configuration the customer must secure

Answer: A — It shrinks, because AWS operates more of the stack

Responsibility shifts with how much of the stack the service abstracts away: the more managed the service, the less is the customer's. The customer still manages its data and permissions, so it does not disappear.

15. A manager assumes that because a workload runs on AWS, AWS is accountable for how the company's own data is protected. Which correction is accurate?

  1. Responsibility is split a fixed 50/50 for every AWS service
  2. AWS secures the customer's data, and the customer secures the hardware and facilities
  3. The customer is responsible only for physical access to the data centre
  4. AWS secures the infrastructure that runs the services, and the customer secures what it puts on top, such as its data and permissions

Answer: D — AWS secures the infrastructure that runs the services, and the customer secures what it puts on top, such as its data and permissions

AWS is responsible for security of the cloud and the customer for security in the cloud, which includes data, encryption, classification and IAM permissions. The split is not fixed; it moves with the service.

16. A customer downloads AWS's PCI compliance report and tells its regulator that the customer's own application is therefore compliant. What is wrong with this reasoning?

  1. The report covers only encryption in transit, so it proves nothing about the application
  2. The report may only be given to AWS Support, never to auditors or regulators
  3. The report documents AWS's compliance; proving the customer's own compliance remains the customer's responsibility
  4. The report is valid only after the customer pays for each download

Answer: C — The report documents AWS's compliance; proving the customer's own compliance remains the customer's responsibility

Artifact gives documents about AWS's compliance, and under the shared responsibility model the customer's own compliance is its own job. Artifact documents can be submitted to auditors and regulators, and it is free.

17. Regulation requires a company to use single-tenant hardware and keep direct control of its encryption keys. Which service fits?

  1. AWS CloudHSM
  2. AWS Key Management Service
  3. AWS Artifact
  4. AWS Secrets Manager

Answer: A — AWS CloudHSM

CloudHSM provides dedicated hardware security modules for cases where regulation demands single-tenant hardware and direct key control. KMS creates and controls keys but is not described as dedicated hardware.

18. An operations team wants metrics, logs and alarms to monitor how an application is behaving. Which service provides this?

  1. AWS CloudTrail
  2. Amazon GuardDuty
  3. AWS Config
  4. Amazon CloudWatch

Answer: D — Amazon CloudWatch

CloudWatch answers how the resource is performing through metrics, logs and alarms. CloudTrail is the audit trail of API calls and Config tracks configuration.

19. The owner of a standalone AWS account decides to close the account. Which sign-in is required to do this?

  1. An IAM Identity Center user
  2. The root user
  3. An IAM user with administrator permissions
  4. A role assumed from another account

Answer: B — The root user

Closing the AWS account is one of the tasks that genuinely requires the root user. An IAM administrator cannot do it on a standalone account.

20. In a standalone account, an S3 bucket policy denies all principals, locking everyone out of the bucket. Who can edit or delete that policy?

  1. The bucket owner through an IAM role
  2. An IAM user with administrator permissions
  3. The root user
  4. Any IAM user in the account with full S3 access

Answer: C — The root user

Editing or deleting an S3 bucket policy that denies all principals is a root-only task on a standalone account.

21. A company wants its 20 developers to receive the same set of permissions by attaching a policy once. Which IAM building block should it use?

  1. An IAM role
  2. An inline policy on each user
  3. An IAM group
  4. The root user

Answer: C — An IAM group

A group is a collection of users, and a policy attached once gives every member the permissions. An inline policy would be attached to a single identity.

22. A contractor needs to read objects in a single S3 bucket for a short project. How should permissions be assigned?

  1. Share the root user credentials for the duration of the project
  2. Grant exactly the permissions needed for the task and no more
  3. Grant access to every bucket in case the scope grows
  4. Grant broad administrator access to avoid later permission requests

Answer: B — Grant exactly the permissions needed for the task and no more

The principle of least privilege means granting exactly the permissions needed for the task and no more.

23. Which two statements describe the root user of an AWS account? (Choose two.)

  1. It exists only for accounts created inside AWS Organizations
  2. Its access is limited to the billing console
  3. It is identified by the email address the account was created with
  4. It has complete access to everything in the account
  5. It cannot use MFA

Answer: C,D — It is identified by the email address the account was created with / It has complete access to everything in the account

Creating an AWS account yields a single sign-in identity with complete access, identified by the account's email address. MFA is enforced for root by default, and new accounts in an organization have no root credentials.

24. A company wants to discover whether objects in its S3 buckets contain personally identifiable information, financial information or credentials. Which service fits?

  1. Amazon GuardDuty
  2. Amazon Inspector
  3. Amazon Macie
  4. AWS Config

Answer: C — Amazon Macie

Macie looks at objects in S3 and finds sensitive data such as PII, financial information and credentials. Inspector examines compute resources, not S3 objects.

25. Which two statements about how GuardDuty and Inspector operate are correct? (Choose two.)

  1. Inspector rescans automatically when something changes or a new CVE lands
  2. GuardDuty runs continuously with no scanning to schedule
  3. Inspector requires a manual rescan after each new CVE
  4. Detective raises new findings by scanning resources
  5. GuardDuty requires scans to be scheduled

Answer: A,B — Inspector rescans automatically when something changes or a new CVE lands / GuardDuty runs continuously with no scanning to schedule

GuardDuty runs continuously and Inspector discovers and rescans automatically. Detective does not find new problems; it investigates root causes.

26. A company needs protection against DDoS attacks and wants to manage its firewall rules centrally across many accounts. Which two services meet these needs? (Choose two.)

  1. Amazon GuardDuty
  2. Amazon Detective
  3. AWS Shield
  4. AWS Firewall Manager
  5. AWS Config

Answer: C,D — AWS Shield / AWS Firewall Manager

Shield provides DDoS protection and Firewall Manager manages firewall rules centrally across accounts. GuardDuty detects threats and Detective investigates findings; neither provides these.

27. Which two kinds of findings does Amazon GuardDuty produce? (Choose two.)

  1. Personally identifiable information in S3 objects
  2. Data exfiltration
  3. Compromised credentials
  4. Publicly accessible S3 buckets
  5. Software vulnerabilities (CVEs) on EC2 instances

Answer: B,C — Data exfiltration / Compromised credentials

GuardDuty finds threats and malicious activity such as compromised credentials and data exfiltration. CVEs are Inspector's, while PII and public buckets are Macie's.

28. A company must build the same infrastructure identically in development, test and production, and wants to eliminate configuration drift between the environments. Which approach fits best?

  1. Describe the infrastructure in a file and have AWS CloudFormation build it
  2. Call the AWS SDKs from an application to create each resource
  3. Run individual AWS CLI commands from an engineer's terminal each time
  4. Create each environment by hand in the AWS Management Console

Answer: A — Describe the infrastructure in a file and have AWS CloudFormation build it

Infrastructure as code with CloudFormation builds identical environments from one description and removes configuration drift. Manual console work or ad hoc commands are not designed to guarantee consistency across environments.

29. An operations engineer wants to run the same set of operations repeatedly by scripting commands at a terminal, without building an application. Which method fits?

  1. AWS SDKs
  2. AWS CLI
  3. AWS Management Console
  4. AWS CloudFormation

Answer: B — AWS CLI

The AWS CLI is for commands at a terminal, scripting and repeatable operations. The SDKs are libraries used inside an application, and the console is a browser interface for one-off tasks.

30. Users around the world see slow downloads of static content, and the company wants copies cached near them. Where is the cached content served from?

  1. An Availability Zone in every Region
  2. The Region closest to company headquarters
  3. Edge locations
  4. A dedicated data centre inside the home Region

Answer: C — Edge locations

Edge locations cache content close to users and serve it with lower latency; they are what Amazon CloudFront uses. They are not where the application itself runs.

31. A workload needs GPUs or purpose-built accelerators. Which EC2 instance family should be chosen?

  1. High-performance computing
  2. Compute optimized
  3. Accelerated computing
  4. General purpose

Answer: C — Accelerated computing

Accelerated computing instances provide GPUs and purpose-built accelerators. Compute optimized is for CPU-heavy work and high-performance computing is for HPC workloads.

32. A company must use its existing per-socket software licences and needs a physical host dedicated to it. Which option fits?

  1. Reserved Instances
  2. Dedicated Hosts
  3. Capacity Reservations
  4. Dedicated Instances

Answer: B — Dedicated Hosts

Dedicated Hosts give a physical host dedicated to you and let you bring per-socket, per-core or per-VM licences. Dedicated Instances are described only as instances on single-tenant hardware paid by the hour, and Capacity Reservations and Reserved Instances do not provide a dedicated host.

33. A team runs containers on Amazon ECS and wants to stop managing the servers those containers run on. What should it use?

  1. AWS Lambda
  2. Amazon ECR
  3. Amazon EKS
  4. AWS Fargate

Answer: D — AWS Fargate

Fargate is serverless compute for containers and works with ECS and EKS. Lambda runs code rather than containers, and ECR only stores container images.

34. A web tier must spread incoming traffic across several instances, and the number of instances must change as demand rises and falls. Which two capabilities provide this? (Choose two.)

  1. Auto Scaling
  2. Edge location caching
  3. Capacity Reservations
  4. A Multi-AZ standby replica
  5. A load balancer

Answer: A,E — Auto Scaling / A load balancer

A load balancer distributes traffic across multiple targets and Auto Scaling adds and removes capacity as demand changes, which delivers elasticity. Edge caching and standby replicas do neither of these jobs.

35. A relational database on Amazon RDS slows down because of heavy read traffic from reporting queries. Which feature scales the reads?

  1. Read replicas
  2. A Multi-AZ instance deployment standby
  3. AWS Database Migration Service
  4. Migrating the database to run on EC2

Answer: A — Read replicas

Read replicas are the feature for scaling reads. The standby in a Multi-AZ instance deployment exists for failover and does not serve read traffic.

36. A company migrates an Oracle database to a PostgreSQL target, and the source must remain usable during the move. Which two tools are used? (Choose two.)

  1. A Multi-AZ deployment
  2. AWS Schema Conversion Tool
  3. Amazon ElastiCache
  4. AWS Database Migration Service
  5. Read replicas

Answer: B,D — AWS Schema Conversion Tool / AWS Database Migration Service

Because the engines differ, SCT converts the schema and DMS moves the data while the source stays usable. Multi-AZ is for failover and read replicas are for scaling reads.

37. A company is choosing how to link its data centre to AWS and is weighing AWS VPN against AWS Direct Connect. Which two statements are accurate? (Choose two.)

  1. A VPN is a dedicated physical link that gives consistent performance.
  2. Direct Connect is a dedicated private physical connection that does not use the internet.
  3. Direct Connect is quicker to provision than a VPN.
  4. VPN traffic is encrypted and travels over the public internet.
  5. Direct Connect traffic travels over the public internet.

Answer: B,D — Direct Connect is a dedicated private physical connection that does not use the internet. / VPN traffic is encrypted and travels over the public internet.

A VPN is an encrypted connection over the public internet, while Direct Connect is a dedicated private physical link not over the internet. Direct Connect takes longer to provision, and consistent performance comes from the dedicated link, not the VPN.

38. Workloads in a VPC must call AWS services while their traffic stays on private IP addresses and never passes through an internet-facing gateway of any kind. Which service provides this?

  1. AWS VPN
  2. AWS PrivateLink
  3. Amazon CloudFront
  4. NAT gateway

Answer: B — AWS PrivateLink

PrivateLink reaches AWS services over private IP addresses without an internet gateway or NAT device. A NAT gateway is exactly the kind of device the requirement excludes, a VPN is an encrypted connection over the public internet, and CloudFront is a content delivery network.

39. A security team wants a secondary guard rail at the subnet boundary in case an instance is ever launched with the wrong security group, and needs to explicitly deny a known bad IP range. Which control fits?

  1. A route table entry
  2. A network ACL
  3. A NAT gateway
  4. An additional security group with a deny rule

Answer: B — A network ACL

Network ACLs act at the subnet level, can deny, and serve as defence in depth if an instance has the wrong security group. Security groups support allow rules only, so they cannot hold a deny rule.

40. Which two S3 storage classes are NOT resilient to the loss of an Availability Zone? (Choose two.)

  1. S3 One Zone-IA
  2. S3 Glacier Instant Retrieval
  3. S3 Standard-IA
  4. S3 Express One Zone
  5. S3 Intelligent-Tiering

Answer: A,D — S3 One Zone-IA / S3 Express One Zone

S3 One Zone-IA and S3 Express One Zone store data in a single AZ. The other classes listed use at least three AZs and survive losing one.

41. A company archives data that it expects to access less than once a year, and it can wait hours for retrieval. Which S3 storage class matches?

  1. S3 Standard-IA
  2. S3 Glacier Deep Archive
  3. S3 Glacier Flexible Retrieval
  4. S3 Glacier Instant Retrieval

Answer: B — S3 Glacier Deep Archive

Deep Archive is designed for archives accessed less than yearly with retrieval in hours. Flexible Retrieval targets archives accessed about yearly, and Instant Retrieval is for quarterly access in milliseconds.

42. A finance team has stacks of scanned paper forms and needs the text on them extracted automatically. Which service should it use?

  1. Amazon Textract
  2. Amazon Comprehend
  3. Amazon Translate
  4. Amazon Rekognition

Answer: A — Amazon Textract

Textract extracts text from scanned documents. Rekognition analyses images and video, and Comprehend finds meaning in text that already exists.

43. A publisher wants to turn written articles into spoken audio and also translate them between languages. Which two services should it use? (Choose two.)

  1. Amazon Polly
  2. Amazon Textract
  3. Amazon Rekognition
  4. Amazon Transcribe
  5. Amazon Translate

Answer: A,E — Amazon Polly / Amazon Translate

Polly converts text to speech and Translate works between languages. Transcribe goes the other way (speech to text), and Rekognition and Textract handle images and scanned documents.

44. When a new order is placed, the inventory, billing and shipping systems must each receive the event, and none of them may miss a message even if it is offline for a while. Which design fits?

  1. A single SQS queue that all three systems read from
  2. An SNS topic with an SQS queue for each system subscribed to it
  3. An SNS topic with the three systems subscribed directly over HTTP
  4. An AWS Step Functions workflow

Answer: B — An SNS topic with an SQS queue for each system subscribed to it

Fanout publishes to an SNS topic with several subscribed SQS queues, so one message reaches many consumers and nothing is lost while one is offline. A single SQS queue is processed by a single subscriber.

45. A company wants to give users access to a single application streamed to their devices, rather than a full virtual desktop. Which service fits?

  1. Amazon WorkSpaces Secure Browser
  2. Amazon WorkSpaces
  3. Amazon AppStream 2.0
  4. AWS Amplify

Answer: C — Amazon AppStream 2.0

AppStream 2.0 streams a single application. WorkSpaces provides full virtual desktops, and Secure Browser delivers a browser as a service.

46. Two accounts belong to the same AWS Organization. The team that owns account A buys a one-year Reserved Instance, but the matching instance usage is running in account B. What is the result?

  1. Usage in account B can receive the discount, because usage is combined across the organization's accounts before discounts are applied.
  2. The discount reaches account B only after AWS Support transfers the Reserved Instance to it.
  3. The discount reaches account B only if account B also buys its own Reserved Instance.
  4. The discount applies only to usage in account A, so the purchase is wasted while account A has no matching usage.

Answer: A — Usage in account B can receive the discount, because usage is combined across the organization's accounts before discounts are applied.

Consolidated billing combines usage across accounts before applying discounts, so an RI bought in one account can lower another account's bill. The other options assume discounts are tied to the purchasing account.

47. A startup is planning a new workload and has not launched any resources yet. It wants a monthly cost estimate for the planned architecture at On-Demand rates. Which tool fits?

  1. AWS Cost Explorer
  2. AWS Cost and Usage Reports
  3. AWS Pricing Calculator
  4. AWS Budgets

Answer: C — AWS Pricing Calculator

The Pricing Calculator estimates what a planned workload will cost before it is built. Cost Explorer, Budgets and CUR all work on cost and usage that already exists.

48. An operations lead wants one place that recommends actions such as removing unused resources, rightsizing instances and adopting Savings Plans or reservations. Which service provides this?

  1. AWS Pricing Calculator
  2. AWS Free Tier page
  3. AWS Cost Anomaly Detection
  4. AWS Cost Optimization Hub

Answer: D — AWS Cost Optimization Hub

Cost Optimization Hub gives recommendations on unused resources, rightsizing, Savings Plans and reservations. Anomaly Detection only alerts on unusual spend.

49. A team lead in a member account asks who pays the charges shown on that member account's bill in an AWS Organization. What is the correct answer?

  1. The member account pays AWS directly, and the management account only reports on it.
  2. The member account pays its share to the management account as a consolidated billing fee.
  3. The management account pays, and the member account's bill is informational only.
  4. AWS splits the charges equally among all accounts in the organization.

Answer: C — The management account pays, and the member account's bill is informational only.

The management account pays the charges of all member accounts, and member bills are informational only. The management account may also reallocate the shared discounts.

50. A company on Business Support+ has a production system that is impaired but still running. What response target applies to this case?

  1. Under 12 hours
  2. Under 1 hour
  3. Under 4 hours
  4. Under 30 minutes

Answer: C — Under 4 hours

A production system impaired has a target of under 4 hours. Under 1 hour applies to production system down, and under 12 hours applies to a system impaired.

51. A security team sees a port-scanning attack against its servers that originates from an EC2 instance belonging to another AWS customer. Where should it report this abuse?

  1. AWS Health Dashboard
  2. AWS Trust and Safety
  3. AWS Support Center, by opening a technical case
  4. AWS re:Post

Answer: B — AWS Trust and Safety

Abuse of AWS resources is reported to the Trust and Safety team, not to Support. re:Post is a community Q&A site and the Health Dashboard shows service events.

52. An engineer wants to ask peers a question on a community Q&A site, and separately needs to raise a case with AWS. Which two resources fit these needs? (Choose two.)

  1. AWS Prescriptive Guidance
  2. AWS Security Blog
  3. AWS Support Center
  4. AWS Trust and Safety
  5. AWS re:Post

Answer: C,E — AWS Support Center / AWS re:Post

re:Post is the community Q&A site and the Support Center is where cases are raised. Trust and Safety handles abuse reports, and the blog and Prescriptive Guidance are reference material.

Take this test interactively

More AWS Cloud Practitioner practice tests